Wazuh's rule engine is deterministic — a rule either fires or it doesn't. ARIA's agentic AI layer handles what rules can't: ambiguous events where the right disposition depends on context that no static rule can capture.
Wazuh's detection model is rule-based: rules fire when log fields match specified conditions. This is effective for known attack patterns — the rule set maps extensively to MITRE ATT&CK techniques and covers the common variants of most documented attack classes. It is also predictable: the same rule fires consistently for the same input, which makes it auditable.
Rules have a structural limitation, though. A rule cannot assess whether a PowerShell invocation is suspicious in context. It fires because PowerShell matching a pattern was executed, regardless of whether this user runs PowerShell regularly, whether the parent process is expected, whether this happened during business hours, or whether there are corroborating events in the past hour. Context is not available to the rule at evaluation time.
ARIA's agentic AI layer is designed for this class of decision. It is not a replacement for Wazuh's rule engine — deterministic rules continue to handle known attack patterns. The AI layer handles the events where context is required to determine whether the alert is benign or worth investigating. These are precisely the events that require analyst time in a manually-triaged environment.
When an agentic AI system processes a Wazuh alert, it does not evaluate the event in isolation. Before the AI sees the alert, enrichment queries run: what does threat intel say about any indicators in this alert, what has this endpoint or user done recently, what MITRE technique did the Wazuh sensor assign. The AI receives all of this context before reasoning.
The AI produces a structured verdict in which each reasoning step cites the evidence that supports it. A verdict that says "this process invocation is consistent with the user's normal pattern" must be supported by the alert history query that shows what the user's normal pattern is. A verdict that says "the parent process is anomalous for this technique" must cite the process telemetry that shows the parent chain.
This multi-step, evidence-cited reasoning is what distinguishes agentic triage from single-pass scoring. A scoring model returns a number. An agentic model returns a structured argument that can be reviewed, challenged, and audited.
Every agentic verdict in ARIA goes to a second model from a different vendor for independent review. The verifier's role is to find gaps: claims that exceed their evidence, required enrichment that was not consulted, confidence levels that seem inconsistent with the data. If the verifier identifies a gap, the verdict is disputed and the alert goes to a security engineer.
The two-model approach reduces correlated failures. If the triage model has a systematic blind spot for a particular Wazuh rule class — a tendency to under-weight certain process parent chains, for example — a verifier from a different vendor is less likely to share that specific failure mode.
Deterministic bypass rules operate outside the agentic pipeline for known-benign patterns. These are narrow rules maintained explicitly for specific Wazuh rule IDs and process signatures that reliably produce false positives. They close alerts before AI is invoked — not as a shortcut but as the correct approach for events that genuinely do not require AI reasoning.
What the agentic layer contributes over Wazuh rules alone:
Book a free assessment to see how the pipeline handles your actual alert environment.
Book Free Assessment